Seoul police arrest seven in South Korea’s first large-scale AI-assisted hacking case

Ringleader allegedly used generative AI tools to breach 90 organizations and steal 8.2 million records

By LineZotpaper AI staff

Published26 October 2026

Read Time2 min

Illustration: Seoul police arrest seven in South Korea’s first large-scale AI-assisted hacking case

Seoul police have arrested seven people in what they call South Korea’s first large-scale hacking operation assisted by generative AI. The campaign allegedly targeted about 90 organizations, including hospitals, universities, and private academies, and stole 8.2 million records. The ringleader, a 32-year-old with no formal IT background, is accused of adding an AI coding agent and an autonomous penetration-testing system in late August, enabling him to breach 60 companies in 44 days.

The Seoul Metropolitan Police Agency announced the arrests Monday, describing the case as the first time suspects in a large-scale AI-assisted hacking operation have been apprehended in South Korea. According to police, the campaign ran from September 2025 through October 2026 and used generative AI tools to automate attacks that would previously have required a hacking group.

Victims included hospitals, universities, private cram schools, golf courses, and subsidiaries of large conglomerates, places holding personal data of ordinary people. One funeral services provider lost 1.22 million records, and some academies held information on minors. The ringleader, who studied arts and physical education, told investigators he taught himself hacking through YouTube and blogs, though police say he worked at a security company from 2019 to 2022 conducting simulated attack work.

Emails to 38 victims demanded a combined 360 million won (about $272,000), but police said the only confirmed payment was 300,000 won ($210). Local reports name the autonomous tool used as Artex. The case opened in June after one victim filed a complaint.

The arrests come amid growing concern over criminal use of AI. In August 2025, Anthropic reported a single criminal using its Claude Code tool for an extortion campaign against at least 17 organizations. However, researchers at Cambridge, Edinburgh, and Strathclyde universities analyzed 97,895 cybercrime forum threads and found AI’s main impact so far in already-automated areas such as SEO fraud and romance scams, with little sign that coding tools helped low-skill actors beyond pre-made scripts.

The ringleader was referred to prosecutors in custody on Friday, facing charges under South Korea’s information and communications network law, extortion, and attempted extortion. Police said they will continue investigating the six accomplices and try to identify additional victims.

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Analysis

Why This Matters

The case demonstrates how generative AI can dramatically lower the barrier for sophisticated cyberattacks, potentially enabling a single individual to conduct operations that once required a coordinated group.
The theft of 8.2 million personal records, including data on minors, highlights the vulnerability of institutions holding sensitive information and the scale of potential privacy harms.
As legal frameworks struggle to keep pace, this arrest sets a precedent for how authorities may pursue AI-enabled crime, but also raises questions about the true extent of AI's role in cybercrime.

Background

Criminal use of AI has been a growing concern, with reports of tools like WormGPT, a ChatGPT clone without safety guardrails, used in 2023 to write convincing phishing emails. In August 2025, Anthropic said a criminal used its Claude Code tool to extort at least 17 organizations. Yet a November 2025 study of nearly 100,000 cybercrime forum posts by researchers at Cambridge, Edinburgh, and Strathclyde universities found that AI's main impact has been in automating existing scams rather than enabling new capabilities for low-skill actors.

Key Perspectives

Seoul Metropolitan Police Agency: Says the arrest marks the first time suspects in a large-scale AI-assisted hacking operation have been caught in South Korea, and that AI now lets one person achieve what once required a group. Researchers at Cambridge, Edinburgh, and Strathclyde universities: In a study of cybercrime forums, found that AI's contribution so far is limited to automating tasks like SEO fraud and romance scams, with little evidence that coding tools helped low-skill actors beyond pre-made scripts.

What to Watch

Further arrests or identification of additional victims as police continue investigating the six accomplices.
Whether this case prompts changes to South Korean cybercrime law or greater scrutiny of AI tools used in hacking.
The potential for copycat attacks as the methods become publicly known, and how AI companies respond to prevent abuse of their tools.

Sources

South Korea Arrests Seven in First Big AI-Assisted Hacking Case · Decrypt

Checked

12 claims in this story checked against 1 source: 10 supported.

Show each claim

SupportedSeoul police arrested seven people in South Korea’s first large-scale AI-assisted hacking case.Decrypt: “Police in Seoul have arrested seven people in a hacking campaign that used generative AI to break into about 90 organizations and steal 8.2 million records. The Seoul Metropolitan Police Agency the case Monday and called it the first time in South Korea that suspects in a large-scale AI-assisted hacking operation have been apprehended.”
Partly supportedThe ringleader used AI tools to breach 90 organizations and steal 8.2 million records.Decrypt: “Police say he then breached 60 companies in 44 days”
SupportedThe campaign used AI to target about 90 organizations and steal 8.2 million records.Decrypt: “Police in Seoul have arrested seven people in a hacking campaign that used generative AI to break into about 90 organizations and steal 8.2 million records.”
SupportedThe 32-year-old ringleader added an AI coding agent and an autonomous penetration-testing tool in late August, then breached 60 companies in 44 days.Decrypt: “In late August, reports say, he added an AI coding agent—a program that writes and runs code on its own—and an autonomous penetration-testing system”
SupportedThe AI tools enabled the ringleader to carry out attacks that would previously have required a hacking group.Decrypt: “Police said an attack of this size once required a hacking group, and that AI now lets one person pull it off in a short time.”
SupportedThe campaign ran from September 2025 through October 2026.Decrypt: “The campaign ran about 13 months, from September 2025 through this October”
SupportedThe ringleader studied arts and physical education, taught himself hacking, and had no IT background.Decrypt: “The alleged ringleader is a 32-year-old who studied arts and physical education and has no IT background, per local reports. He told investigators he taught himself hacking through YouTube and online blogs”
SupportedOne funeral-services provider lost 1.22 million records, and academy data included information on minors.Decrypt: “One funeral services provider lost 1.22 million records, and one report said data from the academies included information on minors.”
SupportedEmails to 38 victims demanded 360 million won, while the only confirmed payment was 300,000 won.Decrypt: “Emails to 38 victims demanded a combined 360 million won, about $272,000, but the only confirmed payment was 300,000 won, about $210.”
Partly supportedThe arrests come amid growing concern over criminal use of AI.Decrypt: “Criminal use of AI has been building for years, mostly in reports from AI companies rather than police.”
SupportedResearchers analyzed 97,895 cybercrime forum threads and found little sign that coding tools helped low-skill actors beyond pre-made scripts.Decrypt: “They found AI’s main impact so far in already-automated areas such as SEO fraud, social media bots and romance scams, with little sign that coding tools helped low-skill actors beyond pre-made scripts.”
SupportedThe ringleader was referred to prosecutors in custody on Friday and faces charges including extortion and attempted extortion.Decrypt: “The ringleader was referred to prosecutors in custody on Friday and faces charges under South Korea’s information and communications network law, plus extortion and attempted extortion.”